SC-100 Identity & Access Management Architecture 3

Question 1

A company is migrating to Azure and needs to synchronize on-premises Active Directory identities to Azure AD while also enabling password hash synchronization as a fallback. Which tool fulfills both requirements?

Accepted Answer

Azure AD Connect with password hash sync enabled

Answer

Azure AD Connect synchronizes on-premises AD objects to Azure AD and optionally replicates password hashes to support cloud authentication.

Question 2

Which Azure AD Conditional Access signal can be used to block access attempts originating from countries where the organization has no business presence?

Accepted Answer

Named locations based on country/region

Answer

Named locations can define allowed or blocked countries/regions, and Conditional Access policies can enforce access restrictions based on those locations.

Question 3

An organization wants to ensure that when a user's account risk level rises to 'high' in Azure AD Identity Protection, access is blocked until the risk is remediated. Which policy type enforces this?

Accepted Answer

User risk policy set to block when user risk is high

Answer

A user risk policy in Identity Protection (or via Conditional Access) blocks or requires password change when user risk reaches the configured threshold.

Question 4

A cybersecurity architect recommends replacing service account passwords with managed identities for Azure workloads. What is the primary security benefit of system-assigned managed identities?

Accepted Answer

They eliminate the need to manage credentials—Azure handles lifecycle automatically

Answer

System-assigned managed identities are created and deleted with the resource, and Azure automatically rotates their credentials, eliminating secrets management burden.

Question 5

Which Azure AD feature allows an architect to define the maximum session lifetime and re-authentication frequency for sensitive applications accessed via Conditional Access?

Accepted Answer

Conditional Access session controls: sign-in frequency and persistent browser session

Answer

Conditional Access session controls for sign-in frequency and persistent browser sessions override default token lifetimes for specific app or user conditions.

(SC-100) Microsoft Cybersecurity Architect Expert Practice Test

(SC-100) Microsoft Cybersecurity Architect Expert Practice Test

SC-100 Identity & Access Management Architecture 3